Organizing OpenWrt Interfaces and Firewall Zones

OpenWrt firewall policy is applied through zones. A zone contains one or more logical networks; forwarding controls traffic between zones.

1. Back up and identify the backend

sysupgrade -b /tmp/firewall-network-backup.tar.gz
cp /etc/config/firewall /tmp/firewall.before
cp /etc/config/network /tmp/network.before
ubus call system board
uci show firewall
uci show network

Newer releases commonly use firewall4/nftables; older releases may use firewall3/iptables. Do not mix configuration or inspection commands without checking the release.

2. Understand the baseline

Typical policy boundaries are lan (trusted management), wan (outside), and guest (untrusted Internet-only). Inspect existing sections before adding duplicates:

uci show firewall | grep -E 'zone|forwarding|rule'
fw4 print 2>/dev/null || iptables-save

3. Define a guest zone

Only do this after the guest logical interface exists in /etc/config/network:

config zone
        option name 'guest'
        list network 'guest'
        option input 'REJECT'
        option output 'ACCEPT'
        option forward 'REJECT'

config forwarding
        option src 'guest'
        option dest 'wan'

If a zone already exists, edit that section instead of creating a duplicate.

4. Permit only DHCP and DNS to the router

config rule
        option name 'Guest-DHCP'
        option src 'guest'
        option proto 'udp'
        option dest_port '67-68'
        option target 'ACCEPT'

config rule
        option name 'Guest-DNS'
        option src 'guest'
        option proto 'tcp udp'
        option dest_port '53'
        option target 'ACCEPT'

These rules are intentionally narrow; do not replace them with a broad input ACCEPT.

5. Block management LAN access

For the sample LAN subnet:

config rule
        option name 'Reject-Guest-to-LAN'
        option src 'guest'
        option dest 'lan'
        option dest_ip '192.168.1.0/24'
        option target 'REJECT'

If the site has other management subnets, cover each boundary deliberately.

6. Review, apply, and inspect

uci changes firewall
uci show firewall
uci revert firewall       # use this before commit if wrong
uci commit firewall
/etc/init.d/firewall reload
fw4 print
nft list ruleset
iptables-save             # older firewall3 systems

7. Test positive and negative paths

From a guest client verify an address, gateway, DNS, and Internet access:

ip addr
ip route
nslookup openwrt.org 192.168.20.1
ping -c 3 1.1.1.1

Then verify that 192.168.1.1, NAS, switch management, and LAN SSH are unreachable. Do not expose LuCI or SSH through a broad WAN ACCEPT rule.

8. Recover

Keep console/LAN recovery when changing policy remotely. If reload locks you out:

cp /tmp/firewall.before /etc/config/firewall
uci commit firewall
/etc/init.d/firewall restart

Source

Source: OpenWrt Firewall and network interfaces .